Contents

List of Tables

1. Introduction

In its everyday business operations, Pre-Action Limited makes use of a variety of data about identifiable individuals, including data about:

  • Current, past and prospective employees
  • Customers
  • Users of its websites
  • Subscribers
  • Other stakeholders

In collecting and using this data, the organisation is subject to a variety of legislation controlling how such activities may be carried out and the safeguards that must be put in place to protect it.

The purpose of this policy is to set out the relevant legislation and to describe the steps Pre-Action Limited is taking to ensure that it complies with it.

This control applies to all systems, people and processes that constitute the organisation’s information systems, including board members, directors, employees, suppliers and other third parties who have access to Pre-Action Limited systems.

The following policies and procedures are relevant to this document:

  • Data Protection Impact Assessment Process
  • Personal Data Mapping Procedure
  • Legitimate Interest Assessment Procedure
  • Information Security Incident Response Procedure
  • GDPR Roles and Responsibilities
  • Records Retention and Protection Policy

2. Privacy and Personal Data Protection Policy

2.1 The General Data Protection Regulation

The General Data Protection Regulation 2016 (GDPR) is one of the most significant pieces of legislation affecting the way that Pre-Action Limited carries out its information processing activities. Significant fines are applicable if a breach is deemed to have occurred under the GDPR, which is designed to protect the personal data of citizens of the European Union. It is Pre-Action Limited’s policy to ensure that our compliance with the GDPR and other relevant legislation is clear and demonstrable at all times.

2.2 Definitions

There are a total of 26 definitions listed within the GDPR and it is not appropriate to reproduce them all here. However, the most fundamental definitions with respect to this policy are as follows:

Personal data means:

Any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, by reference to an identifier such as a name, identification number, location data, online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Processing means:

Any operation or set of operations which is performed on personal data, whether or not by automated means, such as collection, recording, organisation, storage, retrieval, consultation, use, disclosure, alignment, restriction, erasure, or destruction.

Controller means:

The person or body which determines the purposes and means of processing personal data.

2.3 Principles Relating to Processing of Personal Data

The GDPR is based on several key principles. Personal data shall be:

  1. Processed lawfully, fairly, and transparently.
  2. Collected for specified, explicit, and legitimate purposes.
  3. Adequate, relevant, and limited to what is necessary.
  4. Accurate and kept up to date.
  5. Stored only as long as necessary.
  6. Processed securely to prevent unauthorised access or damage.

The controller is responsible for demonstrating compliance with these principles. Pre-Action Limited ensures compliance in all current and future processing activities.

2.4 Rights of the Individual

The data subject has the following rights under the GDPR:

  1. The right to be informed
  2. The right of access
  3. The right to rectification
  4. The right to erasure
  5. The right to restrict processing
  6. The right to data portability
  7. The right to object
  8. Rights in relation to automated decision-making and profiling

Each of these rights is supported by internal procedures allowing appropriate action within GDPR timescales.

Data Subject RequestTimescale
The right to be informedWhen data is collected or within one month
The right of accessOne month
The right to rectificationOne month
The right to erasureWithout undue delay
The right to restrict processingWithout undue delay
The right to data portabilityOne month
The right to objectOn receipt of objection
Rights in relation to automated decision-making and profilingNot specified

Table 1 – Timescales for data subject requests

2.5 Lawfulness of Processing

There are six lawful bases for processing personal data. Pre-Action Limited identifies and documents the appropriate basis for each case:

Explicit consent will be obtained where necessary, especially when processing children’s data. Clear, transparent information will be provided at the point of consent.

2.5.2 Performance of a Contract

Where processing is required to fulfil a contract, consent is not required.

Processing necessary to comply with the law does not require consent.

2.5.4 Vital Interests of the Data Subject

Processing may be lawful where required to protect vital interests of an individual.

2.5.5 Task Carried Out in the Public Interest

Processing may occur for tasks performed in the public interest or under official authority.

2.5.6 Legitimate Interests

Processing that serves Pre-Action Limited’s legitimate interests without infringing on individuals’ rights may be lawful.

2.6 Privacy by Design

Pre-Action Limited applies privacy by design principles to all new or changed systems. Data Protection Impact Assessments (DPIAs) are conducted to assess necessity, proportionality, and risk, ensuring appropriate safeguards are in place.

2.7 Contracts Involving the Processing of Personal Data

All relationships involving data processing are governed by documented contracts containing GDPR-required terms. See GDPR Controller-Processor Agreement Policy.

2.8 International Transfers of Personal Data

Transfers outside the EU are reviewed to ensure GDPR compliance and rely on adequacy decisions or Binding Corporate Rules (BCRs) providing enforceable rights for data subjects.

2.9 Data Protection Officer

Pre-Action Limited does not require a Data Protection Officer (DPO) under GDPR criteria, as it does not engage in large-scale monitoring or sensitive data processing.

2.10 Breach Notification

Pre-Action Limited acts proportionately when managing data breaches. If a breach poses risk to individuals’ rights, the supervisory authority will be informed within 72 hours. This is managed under the Information Security Incident Response Procedure.

2.11 Addressing Compliance to the GDPR

To maintain GDPR accountability, Pre-Action Limited ensures:

  • The legal basis for processing is clear and documented.
  • Staff understand their data protection responsibilities.
  • Training is provided to all relevant employees.
  • Calls are recorded for training and quality purposes.
  • Consent rules are followed.
  • Routes exist for data subjects to exercise their rights.
  • Procedures are regularly reviewed.
  • Privacy by design is embedded in all processes.

The organisation maintains detailed records of processing activities, including:

  • Organisation and contact details
  • Processing purposes
  • Categories of individuals and data
  • Recipients of data
  • Transfer mechanisms for international data
  • Data retention schedules
  • Technical and organisational controls

These actions are reviewed regularly as part of ongoing data protection management.